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lPP' c: Going Dark and Encryption 


Press Guidance: 


Talking Points and Q & A's below are for intci nnl use only, Use these to assist 

thTsTrmat FieTd nf^ ^ T intervi ® ws or in quiries. Do not disseminate this paper in 
f ’ e ^ Offices media reps should handle all local media queries. Calls referrina 

to cases of a national significance rjm be referred to NPO UCj ^ |or PAS 9 


Background: 


O & As: 


How?" 6 G ° ln9 Dark Pr ° blem 90lten ” orse ,or ,aw enforcement over the past year 

The impediments faced by law enforcement have been getting worse for ouite somp timp 
e ommunications Assistance for Law Enforcement Act (CALEA) was enacted in 1994 and 

ove P Intern^^^ Cm,ers ’ I™*'-* of intercon"^ Voice 

thnno, ! t Protocol (VoIP) services, and providers of broadband access services Todav 

ousands of companies provide some form of communication service and most are not Y ' 
required by statute to develop lawful intercept capabilities for law enforcement. As a result 
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man y of today's communication services are developed and deployed without consideration 
of law enforcement's lawful intercept and evidence collection needs consideration 

delude encrvD tin n that* th th * annOUncement from A PP |e that their phones will 

court wm ?K- h ® COmpany ,s not able to un,ock ' even in response to a 
court order? How will this impact the FBI's investigative abilities? 

The FBI continues to be extremely concerned about the serious threat posed by the 
increasing proliferation of encryption technology that prevents timely access to critical 
evidence obtained through legal process. Law enforcement needs the cooperation i and 

' S , ance from l J du * try in complying with lawful court orders so that criminals around the 
world cannot seek safe haven for lawless conduct. una tne 

SSJif V££!Z* t 2! n il 7 ? n#t ,aw enforcement retrieve the same information 
g metadata, the Cloud, or through guessing the password on the phone? 

While law enforcement may be able to obtain some information from communications 

i irfor rrra ti orT i s d^ ffi o' Hr ^ telephon h e records ' email lo 9s, and location information, that 

time Is of the essence - and d ° es not prov,de the 

Idlv,>innM b rhl b no t0 w a i CeSS d ! ta S , t ° red in the Cloud with a search warrant. But backing 
a device up to the Cloud does not include all of the stored data on a particular device fe a 

phone, laptop, tablet). The missing information can create a black hole for law enforcement 

hi Clou? ™ 7 *» ?• Cl °^ » * a target opts out“ktg up to 
tne Cloud, some of the data can only be found on the encrypted device. K 

many fSttL^ 3 sattl " 9 hereby data is erased after too 

P l V Cl ° Se attention t0 law enforcement's diminishing set of capabilities 
and continually seek ways to exploit the gaps. It is vital that capabilities to access the tvoes 

mainSd' 00 ^ t0 Pr ° teCt the public Safety and national securit V of our country are 

a^a resiflt of the a " V r «^ ed c °°P er ation from communication providers 

as a result of the disclosures attributed to Edward Snowden? 

Yes. A number of the country's largest providers have been openly vocal about their 
members ^Con'aress 'Ta'** anC ^ 8nd have published a " °Pen letter to the President and 
"keeping users' data secure - tepEytg til * 

** - ~ » 

What is missing is a vigorous commitment to assist law enforcement when electronic 
rvei ance of a specific criminal target is authorized pursuant to court order. 

What is needed is an open and frank dialogue about the responsibilities of industry to assict 
aw enforcement. Industry and law enforcement need to move forward and develop a 

sid H es pa ? lcipa ! e ln strlkln9 ap «pi«pS» the 

of law en P S;“otett ttSTSS&f “ mPetit '° n inn ° Vat '° n ' 3 " d the ab " ity 

Why does law enforcement believe companies should be forced to build in 
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companies? Vhen desiflnin9 services? Don't backdoors pose a security risk for 

There is a misconceptior 1 that building a lawful intercept solution into a system requires a 
so-caMed "back door," one that foreign adversaries and hackem may try to expS Law 

thl fmnTdonr S "^h 55 ?^" 9 "° r advocatin 9 for a back door. Law enforcement wants to use 
Pr« f r J U d ' Wlth danty and trans P aren cy, and with clear guidance provided by law 

p re v e nt° t e r r o r i s t ^a °t a'clfs * ^ 6 eV ' denCe and informati on needed to investigate crime and 

S^frif adV T S l rie ! WMI , expl0it any vulnerabil 'ty they find. It makes more sense to address 
rarh!r^n kS by deve ' opm 9 'ntercept solutions during the design/development phase, 

~ h, f rtl T’9 to a patchwork solution when law enforcement serves a court order 
ter the fact. Such solutions are likely to be better, smarter, cheaper, and more secure 
than solutions that are retrofitted to existing products. 

J-aniwK 113 ? t0 ® tress that an °P en ' transparent process for identifying technical 
capabilities benefits everyone. First, the public can be assured law enforcement is not 

ing for new authorities. Rather, law enforcement is advocating that industry be able to 

°T P ' y w * h c . ourt orders issued pursuant to existing legal authorities. Second, the industry 

Dianna rh^ ? eS and a " Providers are held to the same standard (i.e., a level 
P ' ay1 " 9 f,eld )- Jh'rd, law enforcement can be confident that it will receive what it needs and 
is authorized by law to collect, regardless of the specific service provider. 

"\* ny com P a .n'es or applications does the FBI encounter where you know 
they will not provide real time data? 

J?!?. a , re l 3T d ? dS 0f communicat 'on service providers that offer new services that do not 
ave a lawful intercept capability. This number continues to grow as technology continues to 

n.r Ltfrt, Pr0V ' der !u 0f new sarvlcas may have a P artlal “Polity to Provide date 
periodically. However, the capabilities are incomplete in that they do not provide all the 

'" f ° r ^ at,on t0 wh ' ch ,aw enforcement is authorized. Further, some of these partial 
capabilities cannot provide information in real-time. 

MmoaSufs" KTSar* 9 ° ver T ent re “ ,vei a daily dump of screen shots from 
companies. Why is this not good enough? 

dailv^ IL C rt!f f ubject t0 . le 9 al process, it may be sufficient that law enforcement receives a 
mannlr P rt of a tar Qet s information. But in many instances, information provided in this 
manner is incomplete or not provided in a timely manner to support every type of 

extort ion ^ d ri iff fra ffi ri^ ^ f spedally w A h , en dealin 9 with reactive crimes (e.g., kidnapping, 
fh ic J- f 9 tr fj ckm 9' terronsm )- Also, not every company has this capability. Further 
there is significant disparity in what companies offering similar services can provide to law 
enforcement there is simply a lack of consistency across the board. 

fa Y >r new electronic surveillance capability laws or see a need to 
update existing laws such as CALEA? 

resped:s ' toda y' s ever-widening gap between technology and law enforcement's 
electronic surve.l ance capabilities is not a new phenomenon. For decades, \a™erft™ment 

has struggled to keep pace with evolving communications technology, periodically requirino 

rea M ti es S Th p d ^ff p rventl ° n ^° ali 9n law enforcement capabilities with new technological 

aTva nd nn h F a r h n.T ^ 3Y / S . the sheer pace at which communications technology is 
advancing. Each passing year brings a dramatic increase in the volume of communications 
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ess 


the sophistication and complexity of communications service offerings, the number of 
communications service providers, and the use of encryption. 

i^ h wfM| a inf a teCh K 0l ° 9 ^ fUe !' n9 th ' S rapid innovation ' however, is simultaneously making 
lawful interception of modern communications services increasingly less feasible. Unless 

corrective action is taken, lawful intercept capabilities will continue to erode and potentially 

become obsolete. Law enforcement needs assistance and cooperation from companies to 

comply with lawful court orders and has to have a way to help these companies understand 

t f ?, eeds Z Why lfc needs and how the y can assist. All of this can be accomplished 
while still protecting privacy rights and providing network security and innovation. 

How will passage of the Domestic Retention and Investigatory Powers fDRIPl 

rSl the , Ur : ited Kingdom, which requires companies to retain customer 
communications data, impact the Going Dark problem in the US? 


It is premature to comment on how the UK legislation will impact United States law 

Sl°n? ment i s ? b '! lty t0 effect court orders - However / it does reflect the fact that the UK is 
facing a similarly daunting challenge in conducting electronic surveillance. 

For any additional questions, including the FBI's use of show cause orders when 

Comm.?n ?^ fuse * t0 . c ° mp,y wlth a court orde »V or the FBI's National Domestic 
Communications Assistance Center, please refer to headquarters. 


